React Site - CVE-2025-55182

README: Vulnerable Next.js project (React RSC landing page)

This repository contains an example of a multi-page corporate landing page built with Next.js 15.0.0 + React 19.0.0. The site mimics a structure similar to t1.ru: home, products, cases, media, about, contacts. We use React Server Components (RSC), Tailwind CSS, Framer Motion for animations, lucide-react for icons, shadcn/ui for badges, and Prisma with SQLite for the database (the contact form saves messages).

The project is intentionally made vulnerable to demonstrate PT-2025-48817 — JSON injection through the contact form, which can lead to RCE/SSRF due to unsafe deserialization in react-server-dom-webpack

Requirements

• Node.js 20.x or higher (because of Prisma). If you have an old version, update it (see below).
• npm (not yarn, the project uses npm).

Installation

1. Clone the repo:

   root@kitploit:~

   git clone <repo-url>
   cd <directory>
   

2. Install dependencies:

   root@kitploit:~

   npm install
   

   If you encounter version issues (e.g., build errors), try:

   root@kitploit:~

   npm install --legacy-peer-deps
   

   Or update Node.js:

   • On Debian/Ubuntu:
     root@kitploit:~

     sudo apt remove --purge nodejs npm -y
     curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
     sudo apt update
     sudo apt install -y nodejs
     node -v  # should be v20.x.x
     

   • Then clean and reinstall:
     root@kitploit:~

     rm -rf node_modules package-lock.json
     npm install
     

3. Initialize Prisma (if needed from scratch):

   root@kitploit:~

   npx prisma init
   npx prisma migrate dev --name init
   

   In .env it should contain: DATABASE_URL="file:./prisma/dev.db".

Running

• Dev mode:

  root@kitploit:~

  npm run dev
  

  Open http://localhost:3000.

• Build and production:

  root@kitploit:~

  npm run build
  npm run start
  

• View the database:

  root@kitploit:~

  npx prisma studio
  

Project structure

• app/: Main folder.
  • components/: Shared components (Header.tsx, Footer.tsx, ProductCard.tsx, NewsItem.tsx).
  • products/: Product list page + dynamic pages by slug ([slug]/page.tsx).
  • cases/, media/, about/, contacts/: Individual pages.
  • layout.tsx: Common layout with Header/Footer.
  • page.tsx: Home page.
  • globals.css: Styles.
• public/: Images (logo.png, images/cases/rimi.jpg, etc.). Add your own or use placeholder.svg.
• prisma/: Database schema (schema.prisma, dev.db).
• actions.ts: Server Actions, including the vulnerable saveMessage for the contact form.

• Animations: Framer Motion on cases (fade-in, scale, 3D-hover). Add 'use client' where needed.
• Contact form: In contacts/page.tsx. Uses Server Action (saveMessage) with validation and loading state. Saves to SQLite.
• Components:
  • ProductCard: With image, tags (Badge), price, status, features, gradients, and hover.
  • NewsItem: Simple news card.
• Vulnerability: In actions.ts — we parse the message as JSON without validation. If you send a crafted payload like { "type": "system", "payload": { "action": "ls" } }, then exec will run the command. This simulates a deserialization attack for RSC